test89078-auth

{"modified":"2026-09-17T23:12:41Z","published":"2026-09-17T23:12:41Z","schema_version":"1.7.4","id":"MAL-2026-16271","summary":"Malicious code in test89078-auth (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c1ac938360c682e2489d11de9278697e7e2e85d73c612d2ab60ed28553bb5573)\nThe package's preinstall script (scripts.preinstall = 'node index.js') runs automatically on npm install and collects os.userInfo().username and os.hostname(), then issues a dns.lookup against a subdomain of 31ee29fe-db68-4fd3-86a2-2b707b9e95f0.dnshook.site with the username and hostname embedded in the queried label. This is a DNS-based exfiltration beacon: installing the package transmits installer host identifiers to a non-first-party canary domain over DNS resolution at install time. The version number 99.99.99 and package name shape are consistent with a dependency-confusion lure targeting an internal package name.\n","affected":[{"package":{"ecosystem":"npm","name":"test89078-auth"},"versions":["99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"3b0597e5ae4f88f7b3e5a35220a907b926c5c8e73c55da0c03ca4c796cf8cab7","tlsh":"dde0abf002a553343a2300ca9194215717d7e65e300ee596bcad839083c2ab4daa051b"}],"package_integrity":[{"filename":"test89078-auth-99.99.99.tgz","hashes":{"sha1":"97f596996e24ea80fb181c247a83ae90596013b8","sha512_sri":"sha512-XfOwBnCnvU2SWA4mQ4IpVAceMvR6i7Jhk0Y1xvR5sqia5xfq+DNDpP+ilazErFcRZAHi4uEiHLvYdeMqDJgHHQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test89078-auth/v/99.99.99"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020140","import_time":"2026-09-17T23:14:58.454057745Z","modified_time":"2026-09-17T23:12:41Z","sha256":"c1ac938360c682e2489d11de9278697e7e2e85d73c612d2ab60ed28553bb5573","source":"amazon-inspector","versions":["99.99.99"]}]}}